Created attachment 614140 [details] Sample module outlining all the permissions required for PITR implementation with SSH and RSync Description of problem: Currently RHEL-shipped SELinux policy is not set up to work with PostgreSQL's PITR (point-in-time recovery). In order to apply most common methods for PITR implementation one needs to manually generate corresponding module. From information I've gathered implementation ends up being fairly similar in each case thus may warrant a tunable implemented in default policies to allow PostgreSQL to transfer WAL files to the secondary node[s]. In my particular case I'm implementing PGPool-II replication with PITR. (Following documentation at: http://www.pgpool.net/docs/latest/pgpool-en.html#online-recovery ). Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-155.el6_3.noarch selinux-policy-3.7.19-155.el6_3.noarch How reproducible: Always. Steps to Reproduce: 1. setup PGPool-II and PITR recovery as per http://www.pgpool.net/docs/latest/pgpool-en.html#online-recovery 1a. namely add to /var/lib/pgsql/data/postgresql.conf: archive_mode = on archive_command = '/usr/bin/rsync %p postgres.3.4:/var/spool/pgsql/wal/%f < /dev/null' which essentially asks postgres to send WAL files over to the secondary machine whenever it reaches checkpoint. 2. launch "psql -U postgres template1" on one of the nodes 3. => select pg_backup_start("backup_test"); 4. => select pg_backup_stop() Actual results: WARNING: pg_stop_backup still waiting for archive to complete (60 seconds elapsed) and a lot of SELinux denials Expected results: operation to succeed. Additional info: PGPool-II used is built using SPEC file in bug #847357 which essentially is a Fedora package rebuilt and tweaked to work in RHEL
Ok, I added a new sepgsql_enable_pitr_implementation boolean to Fedora. Will backport to RHEL6.
Ok optional_policy(` tunable_policy(`postgresql_can_rsync',` rsync_exec(postgresql_t) ') ') optional_policy(` tunable_policy(`postgresql_can_rsync',` ssh_exec(postgresql_t) ssh_read_user_home_files(postgresql_t) corenet_tcp_connect_ssh_port(postgresql_t) ') ') I like this solution more than was my first.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0314.html